[Bug]: Prowler AWS' JSON-OCSF output format is corrupted, not valid JSON about prowler

[jfagoagas]

Awesome, thanks for the heads up @yungcero!

[toniblyx]

Hi @yungcero, I just tried your command on Prowler v4.0 and doesn´t work, are you sure you are using that command and that is the version you have? prowler aws -b --verbose -F my_test should work instead. Remember on v4 JSON OCSF is generated always by default.

[toniblyx]

actually I have just seen what's going on, you have a typo on OCSF on your command. here is the right one prowler aws -b --verbose -M json-ocsf -F my_test

[yungcero]

hey! @toniblyx . Yeah that is my bad. I accidentally mistyped the command when opening the issue. The same error persists however with the correct command

[yungcero]

I also updated the command to have the file name be my-test instead of my_test to be more accurate to what i am running. The naming probably does not matter but just in case...

[jfagoagas]

Hi @yungcero, I can't reproduce your issue in our tests environment. The JSON-OCSF outputs is well generated following JSON syntax.

I just inserted the output in CyberShef using the JSON Minify recipe and it works fine using Prowler v4.

[yungcero]

Looks like it was an edge case in my environment. I restarted my container and updated to 4.0.1 and looks like its good now. This was the output before in cyberchef, but looks like im not running into that issue anymore. And from the output looks like my ocsf json was stuck on a previous version.

Thanks for looking at this @jfagoagas @toniblyx